<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
  
<!-- Mirrored from bos.asmhackers.net/docs/filesystems/ntfs/FILE.html by HTTrack Website Copier/3.x [XR&CO'2013], Tue, 07 Oct 2014 11:26:07 GMT -->
<head>
    <title>NTFS Documentation: FILE record</title>
  </head>

  <body> 
      <h1><a href="index-2.html#NTFS" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/index.html#NTFS">NTFS</a> Documentation: FILE record</h1>

      <h2>Definition</h2>
      This is a component of the <a href="MFT.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/MFT.html">MFT</a>. Each <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> of the <a href="glossary.html#Volume" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Volume">volume</a> is completely described by some of these FILE records. The first FILE record that describes a given <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> is called the <a name="base">base FILE record</a> (or an <a name="inode">inode</a> in <a href="javascript:if(confirm('http://www.linux.org/  \n\nThis file was not retrieved by Teleport Pro, because it is addressed on a domain or path outside the boundaries set for its Starting Address.  \n\nDo you want to open it from the server?'))window.location='http://www.linux.org/'" tppabs="http://www.linux.org/">Linux</a> terminology). All other are called <a name="extension_record">extension FILE records</a>.
      <p>

      <h2>Layout</h2>
      A FILE record is 1 KB large or the <a href="glossary.html#Cluster" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Cluster">cluster</a> size if larger (as far as Helen is concerned, its maximum size is 4 KB, but <a href="javascript:if(confirm('http://www.microsoft.com/ntserver/  \n\nThis file was not retrieved by Teleport Pro, because it is addressed on a domain or path outside the boundaries set for its Starting Address.  \n\nDo you want to open it from the server?'))window.location='http://www.microsoft.com/ntserver/'" tppabs="http://www.microsoft.com/ntserver/">Windows NT&reg;</a> 4 limit is 64 KB). It falls into 2 parts:

      <ul>
	<li><h3><a name="header_part">The header part</a></h3>
            <table border=2 cellspacing=2 cellpadding=2>
	    <tr bgcolor="#E0E0E0">
	      <th>Offset to the beginning of the FILE record</th>
              <th>Length</th>
              <th>Description</th>
            </tr>
	    <tr>
	      <th>0</th>
	      <th>4</th>
	      <th><a href="seqarray.html#magic" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/seqarray.html#magic">Magic number</a> 'FILE'</th>
	    </tr>
	    <tr>
	      <th>4</th>
	      <th>2</th>
	      <th>Offset to the <a href="#up_seq_field">update sequence</a></th>
	    </tr>
	    <tr>
	      <th>6</th>
	      <th>2</th>
	      <th>S=Size of the <a href="#up_seq_a_field">update sequence array</a> + 1</th>
	    </tr>
	    <tr>
	      <th></th>
	      <th></th>
	      <th></th>
	    </tr>
	    <tr>
	      <th>10</th>
	      <th>2</th>
	      <th><a name="sequence_number_field"><a href="#sequence_number">Sequence number</a></a></th>
	    </tr>
	    <tr>
	      <th>12</th>
	      <th>2</th>
	      <th><a name="refcount_field"><a href="#refcount">Reference count</a></a></th>
	    </tr>
	    <tr>
	      <th>14</th>
	      <th>2</th>
	      <th>Offset to the <a href="FILE.html#seqattr" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/FILE.html#seqattr">sequence of attributes part</a></th>
	    </tr>
	    <tr>
	      <th>16</th>
	      <th>2</th>
	      <th><a href="FILE.html#flag" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/FILE.html#flag">Flags</a></th>
	    </tr>
	    <tr>
	      <th>18</th>
	      <th>4</th>
	      <th>Real size of the FILE record</th>
	    </tr>
	    <tr>
	      <th>1C</th>
	      <th>4</th>
	      <th>Allocated size of the FILE record</th>
	    </tr>
	    <tr>
	      <th>20</th>
	      <th>8</th>
	      <th><a href="#pointer">File reference to the base FILE record</a></th>
	    </tr>
	    <tr>
	      <th>28</th>
	      <th>2</th>
	      <th>Maximum attribute Identificator + 1</th>
	    </tr>
 	    <tr>
	      <th>2A</th>
	      <th>2</th>
	      <th><a name="up_seq_field"><a href="seqarray.html#up_seq" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/seqarray.html#up_seq">Update sequence</a></a></th>
	    </tr>
 	    <tr>
	      <th>2C</th>
	      <th>2*(S-1)</th>
	      <th><a name="up_seq_a_field"><a href="seqarray.html#up_seq_a" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/seqarray.html#up_seq_a">Update sequence array</a></a></th>
	    </tr>
          </table>
          <p>

	  <dl>
            <dt><a name="refcount">Reference count</a>
	      <dd>A hard link count.
	      <p>

	    <dt><a name="flag">Flags</a>
	      <dd><table border=2 cellspacing=2 cellpadding=2>
	            <tr bgcolor="#E0E0E0">
	              <th>Bit</th>
	              <th>Signification</th>
                    </tr>
	            <tr>
	              <th>00 01</th>
	              <th><a name="in_use_flag"><a href="#in_use">In use</a></a></th>
	            </tr>
	            <tr>
	              <th>00 02</th>
	              <th>The FILE record describes a <a href="dir.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/dir.html">directory</a></th>
	            </tr>
	          </table>
	      <p>

	    <dt><a name="pointer"><a href="fileref.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/fileref.html">File reference</a> to the <a href="#base">base FILE record</a></a>
	      <dd><ul>
	            <li>If the FILE record is a <a href="#base">base FILE record</a>, the <a href="fileref.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/fileref.html">file reference</a> is 00 00 00 00 00 00 00 00.
	            <li>If the FILE record is an <a href="#extension_record">extension FILE record</a>, the <a href="fileref.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/fileref.html">file reference</a> points to its corresponding <a href="#base">base FILE record</a>.
	          </ul>
	      <p>

	  </dl>

	<li><h3><a name="seqattr">The sequence of attributes part</a></h3>
            This is a sequence of <a href="attribute.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/attribute.html">file attribute</a>s that has a <a href="attribute.html#length" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/attribute.html#length">variable length</a>. <b>In each FILE record</b>, the sequence is ordered by increasing order of the <a href="attribute.html#type" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/attribute.html#type">attribute type</a>. The sequence is <b>terminated with FF FF FF FF</b>.
	    <p>

      </ul>

      <h2>Properties</h2>
      Extension FILE records are used when all information about a <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> doesn't fit into the base FILE record (e.g. if the sequence of <a href="attribute.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/attribute.html">file attribute</a>s grows because the <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> has a lot of <a href="attribute.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/attribute.html">file attribute</a>s or because the <a href="data.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/data.html">data attribute</a> of the <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> has a long <a href="runlist.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/runlist.html">runlist</a> because its <a href="attribute.html#stream" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/attribute.html#stream">stream</a> is very fragmented). Only the base FILE record is used for referencing the <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> it describes. Since the <a href="attribute.html#type" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/attribute.html#type">type</a> of the <a href="attrlist.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/attrlist.html">Attribute List file attribute</a> is small enough, we are sure that this <a href="attribute.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/attribute.html">file attribute</a> will be in the base FILE record. And this <a href="attribute.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/attribute.html">file attribute</a> provides the references to all the extension FILE records describing the <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a>.
      <p>

      When a <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> is deleted, <a name="no_shrink"><a href="index-2.html#NTFS" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/index.html#NTFS">NTFS</a> can't simply remove the associated FILE records from the <a href="MFT.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/MFT.html">MFT</a></a>, otherwise <a href="MFT.html#file_record_number" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/MFT.html#file_record_number">FILE record number</a>s wouldn't be constant over time, and all <a href="fileref.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/fileref.html">file reference</a>s would have to be updated! Instead, the <a name="in_use"><a href="#in_use_flag">in-use flag of a FILE record</a></a> indicates when it is no longer in use. When a <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> is created, an unused FILE record can be re-used for it, but its <a name="sequence_number"><a href="#sequence_number_field">sequence number</a></a> is incremented by one. This mechanism allow <a href="index-2.html#NTFS" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/index.html#NTFS">NTFS</a> to check that <a href="fileref.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/fileref.html">file reference</a>s don't point to deleted <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a>s.
      <p>

      <hr>
      <address><a href="mailto:regis@via.ecp.fr">Regis Duchesne</a> at <a href="javascript:if(confirm('http://www.via.ecp.fr/  \n\nThis file was not retrieved by Teleport Pro, because it is addressed on a domain or path outside the boundaries set for its Starting Address.  \n\nDo you want to open it from the server?'))window.location='http://www.via.ecp.fr/'" tppabs="http://www.via.ecp.fr/">VIA</a>, <a href="javascript:if(confirm('http://www.ecp.fr/  \n\nThis file was not retrieved by Teleport Pro, because it is addressed on a domain or path outside the boundaries set for its Starting Address.  \n\nDo you want to open it from the server?'))window.location='http://www.ecp.fr/'" tppabs="http://www.ecp.fr/">ECP</a>, France</address>
<!-- Created: Tue Dec 10 12:33:35 MET 1996 -->
<!-- hhmts start -->
Last modified: Mon Feb 15 06:37:33 PST 1999
<!-- hhmts end -->
  </body>

<!-- Mirrored from bos.asmhackers.net/docs/filesystems/ntfs/FILE.html by HTTrack Website Copier/3.x [XR&CO'2013], Tue, 07 Oct 2014 11:26:07 GMT -->
</html>
